若无特殊配置登录认证会通过UsernamePasswordAuthenticationFilter来处理

UsernamePasswordAuthenticationFilter继承了抽象类AbstractAuthenticationProcessingFilter

public class UsernamePasswordAuthenticationFilter extends
        AbstractAuthenticationProcessingFilter {
}

AbstractAuthenticationProcessingFilter已经定义了doFilter方法，UsernamePasswordAuthenticationFilter对请求的拦截是通过其父类方法实现的。

public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain)
      throws IOException, ServletException {

   HttpServletRequest request = (HttpServletRequest) req;
   HttpServletResponse response = (HttpServletResponse) res;

   if (!requiresAuthentication(request, response)) {
      chain.doFilter(request, response);

      return;
   }

    ......

   Authentication authResult;

   try {
      // 划重点划重点划重点划重点划重点划重点
      authResult = attemptAuthentication(request, response);
      if (authResult == null) {
         // return immediately as subclass has indicated that it hasn't completed
         // authentication
         return;
      }
      sessionStrategy.onAuthentication(authResult, request, response);
   }
   catch (InternalAuthenticationServiceException failed) {
      logger.error(
            "An internal error occurred while trying to authenticate the user.",
            failed);
      unsuccessfulAuthentication(request, response, failed);

      return;
   }
   catch (AuthenticationException failed) {
      // Authentication failed
      unsuccessfulAuthentication(request, response, failed);

      return;
   }

   // Authentication success
   if (continueChainBeforeSuccessfulAuthentication) {
      chain.doFilter(request, response);
   }

   successfulAuthentication(request, response, chain, authResult);
}

doFilter中核心便是那个attemptAuthentication()方法了，这个AbstractAuthenticationProcessingFilter的抽象方法被UsernamePasswordAuthenticationFilter继承实现了

public Authentication attemptAuthentication(HttpServletRequest request,
            HttpServletResponse response) throws AuthenticationException {
        if (postOnly && !request.getMethod().equals("POST")) {
            throw new AuthenticationServiceException(
                    "Authentication method not supported: " + request.getMethod());
        }

        String username = obtainUsername(request);
        String password = obtainPassword(request);

        if (username == null) {
            username = "";
        }

        if (password == null) {
            password = "";
        }

        username = username.trim();
        
        // 从请求中取出用户名和密码生成 UsernamePasswordAuthenticationToken
        UsernamePasswordAuthenticationToken authRequest = new UsernamePasswordAuthenticationToken(
                username, password);

        // Allow subclasses to set the "details" property
        setDetails(request, authRequest);

        // 获取AuthenticationManager对象，并对Token进行认证
        return this.getAuthenticationManager().authenticate(authRequest);
    }

UsernamePasswordAuthenticationFilter在这个方法中基于用户的用户名和密码生成了token，并将这个token传给AuthenticationManager进行认证。Spring Security有许多AuthenticationManager的实现类，通过Debug可以发现，默认情况下被set到UsernamePasswordAuthenticationFilter中的AuthenticationManager为ProviderManager。

ProviderManager对token进行认证的代码逻辑如下

public Authentication authenticate(Authentication authentication)
      throws AuthenticationException {
   Class<? extends Authentication> toTest = authentication.getClass();
   AuthenticationException lastException = null;
   Authentication result = null;
   boolean debug = logger.isDebugEnabled();
   
   // 调用getProviders()获取所有AuthenticationProvider
   for (AuthenticationProvider provider : getProviders()) {
      // 若这个provider不支持此类型的token，则continue
      if (!provider.supports(toTest)) {
         continue;
      }

      if (debug) {
         logger.debug("Authentication attempt using "
               + provider.getClass().getName());
      }

      try {
         // 使用这个provider对token进行认证
         result = provider.authenticate(authentication);

         if (result != null) {
            // 将authentication的Details拷贝到result
            copyDetails(authentication, result);
            break;
         }
      }
      catch (AccountStatusException e) {
         prepareException(e, authentication);
         // SEC-546: Avoid polling additional providers if auth failure is due to
         // invalid account status
         throw e;
      }
      catch (InternalAuthenticationServiceException e) {
         prepareException(e, authentication);
         throw e;
      }
      catch (AuthenticationException e) {
         lastException = e;
      }
   }
   // result为null且这个ProviderManager的parent不为null
   if (result == null && parent != null) {
      // Allow the parent to try.
      try {
         result = parent.authenticate(authentication);
      }
      catch (ProviderNotFoundException e) {
         // ignore as we will throw below if no other exception occurred prior to
         // calling parent and the parent
         // may throw ProviderNotFound even though a provider in the child already
         // handled the request
      }
      catch (AuthenticationException e) {
         lastException = e;
      }
   }

   // 如果result不为null
   if (result != null) {
      if (eraseCredentialsAfterAuthentication
            && (result instanceof CredentialsContainer)) {
         // 认证完成. 从authentication中移除密码以及其他敏感信息
         ((CredentialsContainer) result).eraseCredentials();
      }

      eventPublisher.publishAuthenticationSuccess(result);
      return result;
   }

   // 执行到这里，可能是因为parent为null或认证未通过或抛出了异常
   // 如果未抛出exception，则是由于provider为null的原因
   if (lastException == null) {
      lastException = new ProviderNotFoundException(messages.getMessage(
            "ProviderManager.providerNotFound",
            new Object[] { toTest.getName() },
            "No AuthenticationProvider found for {0}"));
   }

   prepareException(lastException, authentication);

   throw lastException;
}

上面的代码中，若provider对token的认证未通过，则会调用它的parentAuthenticationManager执行authenticate()

那么这个过程究竟会经过哪些和AuthenticationProvider呢？经过debug跟踪可以发现

第一个ProviderManager有一个AuthenticationProvider，它就是AnonymousAuthenticationProvider，不支持AnonymousAuthenticationProvider类型为UsernamePasswordAuthenticationToken的Authentication。因此会continue到下一个foreach循环，又由于providers列表中只有这一个provider，因此会跳出for循环。判断if (result == null && parent != null)，由于第一个ProviderManager有parent，因此调用parent.authenticate(authentication)对authentication进行认证。

第二个ProviderManager也只有一个AuthenticationProvider，这个Provider便是DaoAuthenticationProvider，DaoAuthenticationProvider支持UsernamePasswordAuthenticationToken此类型的token认证，因此会执行它的authenticate()方法对token进行认证。

DaoAuthenticationProvider继承了抽象类AbstractUserDetailsAuthenticationProvider

public class DaoAuthenticationProvider extends AbstractUserDetailsAuthenticationProvider {
}

DaoAuthenticationProvider的authenticate方法也是在其父类抽象类中定义的

    public Authentication authenticate(Authentication authentication)
            throws AuthenticationException {
        Assert.isInstanceOf(UsernamePasswordAuthenticationToken.class, authentication,
                () -> messages.getMessage(
                        "AbstractUserDetailsAuthenticationProvider.onlySupports",
                        "Only UsernamePasswordAuthenticationToken is supported"));

        // 判断 username
        String username = (authentication.getPrincipal() == null) ? "NONE_PROVIDED"
                : authentication.getName();

        boolean cacheWasUsed = true;
        // 从userCache取用户详细
        UserDetails user = this.userCache.getUserFromCache(username);

        if (user == null) {
            cacheWasUsed = false;

            try {
                // 从缓存取user失败，调用retrieveUser()取用户详细
                user = retrieveUser(username,
                        (UsernamePasswordAuthenticationToken) authentication);
            }
            catch (UsernameNotFoundException notFound) {
                logger.debug("User '" + username + "' not found");

                if (hideUserNotFoundExceptions) {
                    throw new BadCredentialsException(messages.getMessage(
                            "AbstractUserDetailsAuthenticationProvider.badCredentials",
                            "Bad credentials"));
                }
                else {
                    throw notFound;
                }
            }

            Assert.notNull(user,
                    "retrieveUser returned null - a violation of the interface contract");
        }

        try {
            preAuthenticationChecks.check(user);
            additionalAuthenticationChecks(user,
                    (UsernamePasswordAuthenticationToken) authentication);
        }
        // 如果认证失败
        catch (AuthenticationException exception) {
            // 如果是使用缓存的用户详细，考虑是因为缓存的原因导致的
            if (cacheWasUsed) {
                // 将缓存置位false，再取用户信息进行一次认证
                cacheWasUsed = false;
                user = retrieveUser(username,
                        (UsernamePasswordAuthenticationToken) authentication);
                preAuthenticationChecks.check(user);
                additionalAuthenticationChecks(user,
                        (UsernamePasswordAuthenticationToken) authentication);
            }
            else {
                throw exception;
            }
        }
        // 进行后置认证，判断密码是否过期
        postAuthenticationChecks.check(user);

        // 如果认证过程不是使用缓存获取最终用户详细的，将用户详细存入缓存
        if (!cacheWasUsed) {
            this.userCache.putUserInCache(user);
        }

        Object principalToReturn = user;

        // 如果要求PrincipalAsString是字符串，则将用户的用户名传入
        if (forcePrincipalAsString) {
            principalToReturn = user.getUsername();
        }
        
        // 创建成功的认证对象并返回
        return createSuccessAuthentication(principalToReturn, authentication, user);
    }

authenticate方法会先从缓存取用户详细，若取不到，则会调用retrieveUser()方法取用户详细

protected final UserDetails retrieveUser(String username,
        UsernamePasswordAuthenticationToken authentication)
        throws AuthenticationException {
    prepareTimingAttackProtection();
    try {
        UserDetails loadedUser = this.getUserDetailsService().loadUserByUsername(username);
        if (loadedUser == null) {
            throw new InternalAuthenticationServiceException(
                    "UserDetailsService returned null, which is an interface contract violation");
        }
        return loadedUser;
    }
    catch (UsernameNotFoundException ex) {
        mitigateAgainstTimingAttack(authentication);
        throw ex;
    }
    catch (InternalAuthenticationServiceException ex) {
        throw ex;
    }
    catch (Exception ex) {
        throw new InternalAuthenticationServiceException(ex.getMessage(), ex);
    }
}

获取用户详细的方法是调用UserDetailsService.loadUserByUsername()方法，UserDetailsService是接口类，在自己的系统中，可以通过实现这个接口来定义如何获取UserDetails

在调用retrieveUser()方法获得了用户详细后，会利用这个用户详细和登录信息进行比对

preAuthenticationChecks.check(user);
additionalAuthenticationChecks(user,(UsernamePasswordAuthenticationToken) authentication);

DefaultPreAuthenticationChecks是UserDetailsChecker的默认前置认证实现类

    private UserDetailsChecker preAuthenticationChecks = new DefaultPreAuthenticationChecks();


    private class DefaultPreAuthenticationChecks implements UserDetailsChecker {
        public void check(UserDetails user) {
            // 如果账号被锁定
            if (!user.isAccountNonLocked()) {
                logger.debug("User account is locked");

                throw new LockedException(messages.getMessage(
                        "AbstractUserDetailsAuthenticationProvider.locked",
                        "User account is locked"));
            }
            // 如果账号不可用
            if (!user.isEnabled()) {
                logger.debug("User account is disabled");

                throw new DisabledException(messages.getMessage(
                        "AbstractUserDetailsAuthenticationProvider.disabled",
                        "User is disabled"));
            }
            // 如果账号已过期
            if (!user.isAccountNonExpired()) {
                logger.debug("User account is expired");

                throw new AccountExpiredException(messages.getMessage(
                        "AbstractUserDetailsAuthenticationProvider.expired",
                        "User account has expired"));
            }
        }
    }

前置确认通过后，会进入additionalAuthenticationChecks()方法进行额外的认证确认，这个抽象方法被DaoAuthenticationProvider实现。

    protected void additionalAuthenticationChecks(UserDetails userDetails,
            UsernamePasswordAuthenticationToken authentication)
            throws AuthenticationException {
        if (authentication.getCredentials() == null) {
            logger.debug("Authentication failed: no credentials provided");

            throw new BadCredentialsException(messages.getMessage(
                    "AbstractUserDetailsAuthenticationProvider.badCredentials",
                    "Bad credentials"));
        }

        String presentedPassword = authentication.getCredentials().toString();

        if (!passwordEncoder.matches(presentedPassword, userDetails.getPassword())) {
            logger.debug("Authentication failed: password does not match stored value");

            throw new BadCredentialsException(messages.getMessage(
                    "AbstractUserDetailsAuthenticationProvider.badCredentials",
                    "Bad credentials"));
        }
    }

其实就是判断密码是否匹配的过程，会调用用户指定的passwordEncoder对UserDetails的password做解密，然后和客户端提交的密码做比对，以BCryptPasswordEncoder为例

    public boolean matches(CharSequence rawPassword, String encodedPassword) {
        if (encodedPassword == null || encodedPassword.length() == 0) {
            logger.warn("Empty encoded password");
            return false;
        }

        if (!BCRYPT_PATTERN.matcher(encodedPassword).matches()) {
            logger.warn("Encoded password does not look like BCrypt");
            return false;
        }

        return BCrypt.checkpw(rawPassword.toString(), encodedPassword);
    }

在前置认证和额外认证都通过之后，会进行后置认证，DefaultPostAuthenticationChecks是UserDetailsChecker的默认后置认证实现类

    private class DefaultPostAuthenticationChecks implements UserDetailsChecker {
        public void check(UserDetails user) {
            // 判断密码是否过期
            if (!user.isCredentialsNonExpired()) {
                logger.debug("User account credentials have expired");

                throw new CredentialsExpiredException(messages.getMessage(
                        "AbstractUserDetailsAuthenticationProvider.credentialsExpired",
                        "User credentials have expired"));
            }
        }
    }

至此，认证成功后，DaoAuthenticationProvider会生成成功的UsernamePasswordAuthenticationToken并返回给ProviderManager

    protected Authentication createSuccessAuthentication(Object principal,
            Authentication authentication, UserDetails user) {
        // Ensure we return the original credentials the user supplied,
        // so subsequent attempts are successful even with encoded passwords.
        // Also ensure we return the original getDetails(), so that future
        // authentication events after cache expiry contain the details
        UsernamePasswordAuthenticationToken result = new UsernamePasswordAuthenticationToken(
                principal, authentication.getCredentials(),
                authoritiesMapper.mapAuthorities(user.getAuthorities()));
        result.setDetails(authentication.getDetails());

        return result;
    }

因为result不为null，因此跳出providers的遍历认证。认证完成后. ProviderManager从authentication中移除密码以及其他敏感信息并返回给UsernamePasswordAuthenticationFilter。

UsernamePasswordAuthenticationFilter返回认证结果，从attemptAuthentication()方法跳回doFilter()

接着执行session策略

sessionStrategy.onAuthentication(authResult, request, response);

CompositeSessionAuthenticationStrategy是sessionStrategy的具体实现

    public void onAuthentication(Authentication authentication,
            HttpServletRequest request, HttpServletResponse response)
                    throws SessionAuthenticationException {
        // 遍历delegateStrategies
        for (SessionAuthenticationStrategy delegate : this.delegateStrategies) {
            if (this.logger.isDebugEnabled()) {
                this.logger.debug("Delegating to " + delegate);
            }
            delegate.onAuthentication(authentication, request, response);
        }
    }

delegateStrategies的列表默认情况下只有一个，实现了SessionAuthenticationStrategy的AbstractSessionFixationProtectionStrategy

    /**
     * Called when a user is newly authenticated.
     * <p>
     * If a session already exists, and matches the session Id from the client, a new
     * session will be created, and the session attributes copied to it (if
     * {@code migrateSessionAttributes} is set). If the client's requested session Id is
     * invalid, nothing will be done, since there is no need to change the session Id if
     * it doesn't match the current session.
     * <p>
     * If there is no session, no action is taken unless the {@code alwaysCreateSession}
     * property is set, in which case a session will be created if one doesn't already
     * exist.
     */
    public void onAuthentication(Authentication authentication,
            HttpServletRequest request, HttpServletResponse response) {
        boolean hadSessionAlready = request.getSession(false) != null;

        if (!hadSessionAlready && !alwaysCreateSession) {
            // Session fixation isn't a problem if there's no session

            return;
        }

        // Create new session if necessary
        HttpSession session = request.getSession();

        if (hadSessionAlready && request.isRequestedSessionIdValid()) {

            String originalSessionId;
            String newSessionId;
            Object mutex = WebUtils.getSessionMutex(session);
            synchronized (mutex) {
                // We need to migrate to a new session
                originalSessionId = session.getId();

                session = applySessionFixation(request);
                newSessionId = session.getId();
            }

            if (originalSessionId.equals(newSessionId)) {
                logger.warn("Your servlet container did not change the session ID when a new session was created. You will"
                        + " not be adequately protected against session-fixation attacks");
            }

            onSessionChange(originalSessionId, session, authentication);
        }
    }

默认情况下alwaysCreateSession为false，代码中只需要关注hadSessionAlready这个字段即可

最后，执行doFilter()中的最后一行代码successfulAuthentication(request, response, chain, authResult)，successfulAuthentication也是在UsernamePasswordAuthenticationFilter的抽象父类中定义好的方法

    protected void successfulAuthentication(HttpServletRequest request,
            HttpServletResponse response, FilterChain chain, Authentication authResult)
            throws IOException, ServletException {

        if (logger.isDebugEnabled()) {
            logger.debug("Authentication success. Updating SecurityContextHolder to contain: "
                    + authResult);
        }
        // 向SecurityContextHolder放入认证信息
        SecurityContextHolder.getContext().setAuthentication(authResult);

        rememberMeServices.loginSuccess(request, response, authResult);

        // Fire event
        if (this.eventPublisher != null) {
            eventPublisher.publishEvent(new InteractiveAuthenticationSuccessEvent(
                    authResult, this.getClass()));
        }

        successHandler.onAuthenticationSuccess(request, response, authResult);
    }

大体就是向SecurityContextHolder中放入认证的信息，然后调用successHandler.onAuthenticationSuccess()处理认证成功操作，successHandler的默认实现是SavedRequestAwareAuthenticationSuccessHandler

@Override
    public void onAuthenticationSuccess(HttpServletRequest request,
            HttpServletResponse response, Authentication authentication)
            throws ServletException, IOException {
        // 将请求存入请求缓存session中
        SavedRequest savedRequest = requestCache.getRequest(request, response);

        if (savedRequest == null) {
            super.onAuthenticationSuccess(request, response, authentication);

            return;
        }
        String targetUrlParameter = getTargetUrlParameter();
        if (isAlwaysUseDefaultTargetUrl()
                || (targetUrlParameter != null && StringUtils.hasText(request
                        .getParameter(targetUrlParameter)))) {
            requestCache.removeRequest(request, response);
            super.onAuthenticationSuccess(request, response, authentication);

            return;
        }

        clearAuthenticationAttributes(request);

        // Use the DefaultSavedRequest URL
        String targetUrl = savedRequest.getRedirectUrl();
        logger.debug("Redirecting to DefaultSavedRequest Url: " + targetUrl);
        getRedirectStrategy().sendRedirect(request, response, targetUrl);
    }

默认不存session，因此if (savedRequest == null)条件成立，调用super.onAuthenticationSuccess()处理，然后return

SavedRequestAwareAuthenticationSuccessHandler其父类是SimpleUrlAuthenticationSuccessHandler

    public void onAuthenticationSuccess(HttpServletRequest request,
            HttpServletResponse response, Authentication authentication)
            throws IOException, ServletException {

        handle(request, response, authentication);
        clearAuthenticationAttributes(request);
    }

handle()方法代码如下，其实就是将页面重定向回登录跳转之前的请求页

    protected void handle(HttpServletRequest request, HttpServletResponse response,
            Authentication authentication) throws IOException, ServletException {
        String targetUrl = determineTargetUrl(request, response);

        if (response.isCommitted()) {
            logger.debug("Response has already been committed. Unable to redirect to "
                    + targetUrl);
            return;
        }

        redirectStrategy.sendRedirect(request, response, targetUrl);
    }

在handle()方法执行结束以后，会执行clearAuthenticationAttributes()

    /**
     * Removes temporary authentication-related data which may have been stored in the
     * session during the authentication process.
     */
    protected final void clearAuthenticationAttributes(HttpServletRequest request) {
        HttpSession session = request.getSession(false);

        if (session == null) {
            return;
        }

        session.removeAttribute(WebAttributes.AUTHENTICATION_EXCEPTION);
    }

其实就是从session中移除认证的信息，至此登录处理逻辑结束，收工